CVE-2006-6877: Directory traversal vulnerability in index.php in Matteo Lucarelli 3editor CMS 0.42 and earlier, when regis...

Security readout for executives and security teams

3editor CMS 0.42 and earlier can let a remote attacker make the site include files by manipulating a page request parameter, but only when PHP register_globals is enabled. This is an old product and the provided data does not show current active exploitation. Exposure is likely limited to legacy internet-facing 3editor CMS 0.42 or earlier deployments with register_globals enabled. The provided affected-product metadata is incomplete, so asset confirmation is essential. Prioritize discovery and containment if this CMS exists in production. The product is obsolete, exploit reference exists, and remediation details are sparse, so replacement or isolation may be more realistic than patching. Mitigation focus: Identify any 3editor CMS deployments and confirm version.; Disable register_globals where still present.; Restrict external access to legacy 3editor sites until assessed..

Prepared

Jun 29, 2026, 08:30 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.